Researchers, including teams at Anthropic and EPFL, demonstrated that self-propagating instructions can spread from one AI agent to another through the editable prompt and state files that autonomous agent harnesses use to carry context between sessions. In simulated multi-agent coding setups, a payload written into a shared file could infect the next agent that read it. The researchers call the risk real but currently limited, noting there is no sign of it spreading in the wild and that compromising one agent usually already grants machine access. Encouragingly, adding a single short warning paragraph to an agent's system prompt cut propagation to nearly zero across the payloads they tested.
Researchers disclosed flaws in Paperclip, an AI agent tool, that let attackers run commands on a user's machine through malicious agent imports. The more serious path, CVE-2026-41679 and scored 10.0, needs no account or user interaction against network-reachable deployments running in authenticated mode with the default registration configuration. A second path, scored 9.6, requires a victim to open an attacker-controlled page while Paperclip runs in its default local trusted mode. A third issue exposed sensitive data and control-plane details through API routes that skipped access checks. The fixes, which add import authorization and hostname validation, ship in the version tagged 2026.416.0.
Pillar Security showed that Google's Agent Development Kit repository could be turned against itself through a poisoned pull request or issue. The public repository ran a low-privileged triage agent that responded to outside contributions, and a higher-privileged agent reserved for maintainers. Because the triage agent posted through a bot account that counted as a repository collaborator, a prompt injection could make it post a command that satisfied the privileged workflow's trust check, invoking the maintainer-level agent. That crossed into a job holding a long-lived access token, a Google API key, and a cloud service-account credential, enabling code execution on the runner and secret theft. Google deleted the affected workflows.
Noma Labs found a critical flaw in Ruflo, an open-source platform for orchestrating swarms of AI agents that acts as a harness for coding agents like Claude Code and Codex. Tracked as CVE-2026-59726 and scored 10.0, the flaw is that Ruflo's default Docker deployment exposed its Model Context Protocol bridge to the network with no authentication, offering 233 callable tools. A single unauthenticated request could invoke a shell command tool to run code in the bridge container, read AI provider API keys, steal stored conversations, and poison the platform's persistent agent memory, which can steer future outputs even after the attacker leaves. The flaw is in Ruflo, not in the coding agents.
Offensive security firm Manifold Security detailed a confused deputy flaw in Microsoft's official Azure DevOps MCP server, which lets AI agents read and operate Azure DevOps on a user's behalf across pull requests, pipelines, wikis, and work items, using that user's own permissions. One of the server's tools returns pull request descriptions without the prompt injection guardrail Microsoft had already applied to other tools. Because descriptions accept Markdown, an attacker can bury instructions in an HTML comment: the web interface renders it as nothing, so a reviewer sees an ordinary change, while the REST API returns the text verbatim and hands it straight to the agent.
Researchers demonstrated MemGhost, an attack that uses one email to plant a false, persistent memory in an AI personal assistant with inbox access. Because these assistants keep notes about the user and reload them every session, a crafted message can trick the agent into saving a fabricated fact while keeping its reply innocuous, so the tampering goes unnoticed and steers later answers. The team trained an attacker model to write such emails automatically, reporting high success against open-source and commercial agents and showing it transfers across memory backends and survives several defenses. Unlike earlier one-shot injection that leaked data only in the moment, MemGhost's memory persists long after the email is gone.
Varonis disclosed a now-patched flaw in Google Cloud's Dialogflow CX, the platform many companies use to build customer-service, financial, and healthcare chatbots. Because all chatbots using the platform's custom-code feature in one Google Cloud project shared a single execution environment with a writable setup file and no isolation, an attacker who could edit one agent, needing only a single low-level permission, could overwrite that file and hijack every chatbot in the project. From there they could read live conversations, steal shared data, and make bots ask for passwords. Google reported no exploitation before fixing it and no customer action is now required, but the case shows how AI features inherit cloud risks.
Researchers at the Hong Kong University of Science and Technology showed that the static scanners meant to vet add-on "skills" for AI coding agents like Claude Code can be fooled while the malware keeps working. Their technique, SkillCloak, either rewrites the tell-tale bytes a scanner looks for, using look-alike characters and line breaks, or hides the whole payload in a directory scanners skip, such as .git, behind a decoder that rebuilds it only when the agent runs the skill. Across eight scanners and 1,613 real malicious skills, the packing trick evaded detection more than 90 percent of the time. The researchers argue static scanning is not enough and released a runtime checker.
Zscaler found attackers using search-engine poisoning and hidden instructions on malicious websites to manipulate AI agents into making cryptocurrency payments. In one case, a hidden element on the page tells an AI agent that it must "resolve an error" by completing a payment, alongside code that starts a crypto transfer to a hardcoded wallet; the same page also shows human visitors ordinary payment options. Another campaign typosquats a decentralized-finance portfolio tracker and uses hidden prompts to convince agents the fake site is the real one. The attacker is seeding the scheme through several GitHub repositories, showing how autonomous agents that browse and act can be steered by content they read.
Microsoft is warning that attackers can hijack AI agents through poisoned tool descriptions, the plain-text notes that tell an agent what a tool does. Because agents connect to systems through the Model Context Protocol and read these descriptions to decide how to act, an attacker who updates a trusted third-party tool can bury a hidden instruction in its description, telling the agent to quietly collect and exfiltrate data on its next task. Many setups pick up description changes without re-approval, so the poisoned version goes live silently. Each step the agent takes looks legitimate and runs with the user's own permissions, so no alarm fires.
TrustStrike Labs